ML071380478

IR 05000416-07-006, on 02/12/07 to 03/14/07, Grand Gulf, Special Inspection in Response to Division I Standby Diesel Generator High Temperature on 01/30/07

ML071380478
Person / Time
Site:	Grand Gulf
Issue date:	05/18/2007
From:	Hay M NRC/RGN-IV/DRP/RPB-C
To:	Brian W Entergy Operations
References
IR-07-006
Download: ML071380478 (32)

See also: IR 05000416/2007006

Text

May 18, 2007

William R. Brian, Vice

President, Operations

Grand Gulf Nuclear Station

Entergy Operations, Inc.

P.O. Box 756

Port Gibson, MS 39150

SUBJECT: GRAND GULF NUCLEAR STATION - NRC SPECIAL INSPECTION

REPORT 05000416/2007006

Dear Mr. Brian:

On March 14, 2007, the U.S. Nuclear Regulatory Commission (NRC) completed a special

inspection at your Grand Gulf Nuclear Station facility. This inspection examined activities

associated with the Division I standby diesel generator (SDG) high temperature event that

occurred on January 30, 2007. On this occasion, the SDG experienced elevated temperatures

in the jacket water and lube oil subsystems. The NRC's initial evaluation satisfied the criteria in

NRC Management Directive 8.3, NRC Incident Investigation Program, for conducting a special

inspection. The basis for initiating this special inspection is further discussed in this report,

which is included as Attachment 2. The determination that the inspection would be conducted

was made by the NRC on February 8, 2007, and the inspection started on February 12, 2007.

The enclosed inspection report documents the inspection findings, which were discussed on

March 14, 2007 and again on April 25, 2007, with you and other members of your staff. The

inspection examined activities conducted under your license as they relate to safety and

compliance with the Commission's rules and regulations and with the conditions of your license.

The inspectors reviewed selected procedures and records, observed activities, and interviewed

personnel.

The report documents four findings which were determined to be violations of very low safety

significance. Because of their very low safety significance and because they were entered into

your corrective action program, the NRC is treating these findings as noncited violations

consistent with Section VI.A.1 of the NRC Enforcement Policy. If you contest these NCVs, you

should provide a response within 30 days of the date of this inspection report, with the basis for

your denial, to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk,

Washington DC 20555-0001; with copies to the Regional Administrator, U.S. Nuclear

Regulatory Commission Region IV, 611 Ryan Plaza Drive, Suite 400, Arlington, Texas,

76011-4005; the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission,

Washington DC 20555-0001; and the NRC Resident Inspector at the Grand Gulf Nuclear

Station facility.

Entergy Operations, Inc. -2-

In accordance with 10 CFR 2.390 of the NRC's Rules of Practice, a copy of this letter, its

enclosure, and your response (if any) will be made available electronically for public inspection

in the NRC Public Document Room or from the Publicly Available Records (PARS) component

of NRCs document system (ADAMS). ADAMS is accessible from the NRC Web site at

http://www.nrc.gov/reading-rm/adams.html (the Public Electronic Reading Room).

Sincerely,

/RA

Michael C. Hay, Chief

Reactor Projects Branch C

Docket: 50-416

License: NPF-29

Enclosure: Inspection Report 05000416/2007006

Attachment 1: Supplemental Information

Attachment 2: Special Inspection Charter

Attachment 3: Significance Determination Evaluation

cc w/Enclosure:

Executive Vice President

and Chief Operating Officer

Entergy Operations, Inc.

P.O. Box 31995

Jackson, MS 39286-1995

Chief

Energy & Transportation Branch

Environmental Compliance and

Enforcement Division

Mississippi Department of

Environmental Quality

P.O. Box 10385

Jackson, MS 39289-0385

President

Claiborne County Board of Supervisors

P.O. Box 339

Port Gibson, MS 39150

General Manager, Plant Operations

Grand Gulf Nuclear Station

Entergy Operations, Inc.

P.O. Box 756

Port Gibson, MS 39150

Entergy Operations, Inc. -3-

Attorney General

Department of Justice

State of Louisiana

P.O. Box 94005

Baton Rouge, LA 70804-9005

Office of the Governor

State of Mississippi

Jackson, MS 39205

Attorney General

Assistant Attorney General

State of Mississippi

P.O. Box 22947

Jackson, MS 39225-2947

State Health Officer

State Board of Health

P.O. Box 139

Jackson, MS 39205

Director

Nuclear Safety & Licensing

Entergy Operations, Inc.

1340 Echelon Parkway

Jackson, MS 39213-8298

Director, Nuclear Safety Assurance

Entergy Operations, Inc.

P.O. Box 756

Port Gibson, MS 39150

Richard Penrod, Senior Environmental

Scientist, State Liaison Officer

Office of Environmental Services

Northwestern State University

Russsell Hall, Room 201

Natchitoches, LA 71497

Entergy Operations, Inc. -4-

Electronic distribution by RIV:

Regional Administrator (BSM1)

DRP Director (ATH)

DRS Director (DDC)

DRS Deputy Director (RJC1)

Senior Resident Inspector (GBM)

Branch Chief, DRP/C (MCH2)

Senior Project Engineer, DRP/C (WCW)

Team Leader, DRP/TSS (CJP)

RITS Coordinator (MSH3)

DRS STA (DAP)

L. Trocine, OEDO RIV Coordinator (LXT)

ROPreports

GG Site Secretary (NAS2)

K. Fuller, RC/ACES (KSF)

C. Carpenter, D:OE (CAC)

G. Vasquez (GMV)

OE:EA File (RidsOeMailCenter)

SUNSI Review Completed: _WCW__ ADAMS: : Yes G No Initials: _WCW__

Publicly Available G Non-Publicly Available G Sensitive  : Non-Sensitive

R:\_REACTORS\GG\2007\GG2007-06RP-RWD.wpd

RIV:SRI:DRP/E RI:DRP/C SRI:DRP/C SRA:DRS C:DRP/C

RWDeese AJBarrett GBMiller RLBywater MCHay

T-WCWalker E-WCWalker MCHay for /RA/ /RA/

5/17/07 5/14/07 5/16/07 5/13/07 5/18/07

OFFICIAL RECORD COPY T=Telephone E=E-mail F=Fax

U.S. NUCLEAR REGULATORY COMMISSION

REGION IV

Docket: 50-416

Licenses: NPF-29

Report No.: 05000416/2007006

Licensee: Entergy Operations, Inc.

Facility: Grand Gulf Nuclear Station

Location: Waterloo Road

Port Gibson, Mississippi 39150

Dates: February 12 through March 14, 2007

Inspectors: A. Barrett, Resident Inspector, Grand Gulf Nuclear Station

R. Bywater, Senior Reactor Analyst

R. Deese, Senior Resident Inspector, Arkansas Nuclear One

G. Miller, Senior Resident Inspector, Grand Gulf Nuclear Station

Approved By: Michael C. Hay, Chief

Project Branch C

Division of Reactor Projects

-1- Enclosure

SUMMARY OF FINDINGS

IR 05000416/2007006; 02/12/07 - 03/14/07; Grand Gulf Nuclear Station; Special Inspection in

response to Division I Standby Diesel Generator high temperatures on January 30, 2007.

The report covered a 4-day period (February 12-15, 2007) of onsite inspection, with inoffice

review through March 14, 2007, by a special inspection team consisting of one senior resident

inspector, one resident inspector, and one senior reactor analyst. Four findings were identified.

The significance of most findings is indicated by its color (Green, White, Yellow, Red) using

Inspection Manual Chapter 0609, Significance Determination Process. Findings for which the

significance determination process does not apply may be Green or be assigned a severity

level after NRCs management review. The NRC's program for overseeing the safe operation

of commercial nuclear power reactors is described in NUREG-1649, Reactor Oversight

Process, Revision 3, dated July 2000.

Summary of Event

The NRC conducted a special inspection to better understand the circumstances surrounding

high temperatures on the Division I standby diesel generator jacket water and lube oil systems

on January 30, 2007. In accordance with NRC Management Directive 8.3, NRC Incident

Investigation Program, it was determined that this event involved repetitive failures of

safety-related equipment having potential adverse generic implications and had sufficient risk

significance to warrant a special inspection.

A. NRC-Identified and Self-Revealing Findings

Cornerstone: Mitigating Systems

• Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Action, involving the failure to identify and correct the

cause of elevated temperatures adversely affecting the safety function of the

Division I standby diesel generator that had previously occurred in 1999 and 2004.

Subsequently, on January 30, 2007, the Division I standby diesel generator again

experienced elevated temperatures during a surveillance run and was

subsequently declared inoperable. This issue was entered into the licensee's

corrective action program as Condition Report GGN-2007-0378.

The finding is greater than minor because it is associated with the mitigating

systems cornerstone attribute of equipment performance and affects the

cornerstone objective to ensure the availability, reliability, and capability of systems

that respond to initiating events to prevent undesirable consequences. The

Phase 1 Worksheets in Manual Chapter 0609, Significance Determination

Process, were used to conclude that a Phase 2 analysis was required because

the condition represented a loss of safety function of a single train of a Technical

Specification system for greater than its allowed outage time. The inspectors

performed a Phase 2 analysis using Appendix A, Technical Basis For At Power

Significance Determination Process, of Manual Chapter 0609, Significance

Determination Process, and the Phase 2 Worksheet for Grand Gulf. The Phase 2

evaluation concluded that the finding was of very low safety significance. A

Phase 3 significance determination analysis also determined the finding was of

very low safety significance. The cause of the finding is related to the problem

-2- Enclosure

identification and resolution crosscutting area in that the licensee failed to

thoroughly evaluate the problem resulting in ineffective corrective actions being

implemented that failed to prevent recurrence of a significant condition adverse to

quality (Section 3.0).

• Green. The team identified a noncited violation of Technical Specification 5.4.1 (a)

involving the failure to maintain an adequate alarm response instruction for

standby diesel generator high jacket water temperature. Specifically,

Procedure 04-1-02-1H22-P400, Alarm Response Instruction, Panel

No.: 1H-22-P400, Safety Related, Revision 109, failed to provide adequate

guidance to manually override the standby diesel generator jacket water cooling

system temperature control valve during emergency conditions. This issue was

entered into the licensee's corrective action program as

Condition Report GG-2007-1837.

The finding is greater than minor because it is associated with the mitigating

systems cornerstone attribute of procedure quality and affects the cornerstone

objective to ensure the availability, reliability, and capability of systems that

respond to initiating events to prevent undesirable consequences. Using Manual

Chapter 0609, Significance Determination Process, Phase 1 Worksheet, the

finding is determined to have very low safety significance because it did not screen

as potentially risk significant due to a seismic, flooding, or severe weather initiating

events. The cause of the finding is related to the problem identification and

resolution crosscutting area in that the licensee did not take appropriate corrective

actions to adequately address a previously identified safety concern (Section 4.0).

• Green. The team identified a noncited violation of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Action, involving the failure to promptly identify a

condition adverse to quality. Between February 2-15, 2007, the licensee failed to

promptly identify that corrective actions taken in response to a January 30, 2007,

failure of the Division 1 standby diesel generator jacket water cooling system

temperature control valve had not addressed the cause of the valve failure.

Specifically, following the valves failure, the licensee inappropriately concluded the

valves internal thermal elements were faulty, replaced the elements, performed

postmaintenance testing, and declared the valve and associated standby diesel

generator operable on February 1, 2007. Subsequent testing of the suspect faulty

thermal elements on February 2 and 13, 2007, found the components were

functional. Following receipt of the testing results, the licensee failed to promptly

identify that replacement of the thermal elements failed to address the cause of

the problem resulting in the failure to evaluate a potential degraded condition

affecting operability of the standby emergency diesel generator. This issue was

entered into the licensee's corrective action program as

Condition Report GGN-2007-2255.

The finding is greater than minor because it is associated with the mitigating

systems cornerstone attribute of equipment performance and affects the associate

cornerstone objective to ensure the availability, reliability, and capability of systems

that respond to initiating events to prevent undesirable consequences. Using

Manual Chapter 0609, Significance Determination Process, Phase 1 Worksheet,

the finding is determined to have very low safety significance because the

condition did not screen as potentially risk significant due to a seismic, flooding, or

-3- Enclosure

severe weather initiating events. The cause of the finding is related to the problem

identification and resolution crosscutting area in that the licensee did not identify

an issue completely, accurately, and in a timely manner commensurate with its

safety significance resulting in the failure to evaluate a potential degraded

condition for operability (Section 5.0).

• Green. The inspectors identified a Green noncited violation of 10 CFR Part 50

Appendix B, Criterion V, Instructions, Procedures, and Drawings, for a failure to

follow procedures which resulted in an inadequate operability evaluation.

Specifically, the evaluation did not include an analysis of conditions that could be

causing the valve to fail, and it provided no assessment of the effect these

conditions would have related to the specified safety function and mission time of

the standby diesel generator. The licensee entered this issue in their corrective

action program as Condition Report GGN-2007-2256.

This finding is more than minor because the failure to perform an adequate

operability evaluation, if left uncorrected, could become a more significant safety

concern. Using Manual Chapter 0609, Significance Determination Process,

Phase 1 Worksheet, this finding was of very low safety significance since it did not

result in a loss of operability. The cause of this finding has a crosscutting aspect

in the area of human performance associated with decision making because

licensee personnel failed to use conservative assumptions and did not verify the

validity of the underlying assumptions used in making safety-significant decisions

(Section 5.0).

B. Licensee-Identified Violations

None

-4- Enclosure

REPORT DETAILS

1.0 SPECIAL INSPECTION SCOPE

The NRC conducted a special inspection at Grand Gulf Nuclear Station (GGNS) to

better understand the circumstances surrounding the high temperatures observed in the

jacket water system of the Division I standby diesel generator (SDG). The diesel

generator was manually shutdown during a surveillance run on January 30, 2007, when

the jacket water high temperature alarm annunciated. A failed jacket water cooling

system on the SDG could have overheated the diesel, potentially impacting the ability of

the SDG to perform its safety function during a design basis accident. In accordance

with NRC Management Directive 8.3, it was determined that this event had sufficient risk

significance to warrant a special inspection.

The team used NRC Inspection Procedure 93812, Special Inspection Procedure, to

conduct the inspection. The special inspection team reviewed procedures, corrective

action documents, operator logs, design documentation, maintenance records, and

procurement records for the Division I SDG. The team interviewed various station

personnel regarding the event. The team reviewed the licencees preliminary root cause

analysis report, past failure records, extent of condition evaluation, immediate and long

term corrective actions, and industry operating experience. A list of specific documents

reviewed is provided in Attachment 1. The charter for the special inspection is included

as Attachment 2.

2.0 SYSTEM AND EVENT DESCRIPTION

2.1 System Description

GGNS uses three diesel generators to provide standby power to safety-related

equipment required to shutdown the reactor, maintain the reactor in a safe shutdown

condition, and mitigate the consequences of an accident. These diesel generators

supply electrical buses designated by division number: Division I, Division II, and

Division III. The Division I and II SDGs are Transamerica Delaval, Incorporated engines

rated at 5740 kw. The engines are DSRV-4 series (16-cylinder, 4-stroke, turbocharged,

and 45E V-type) and are designed to operate at 450 revolutions per minute.

The GGNS Transamerica Delaval, Incorporated engines use an independent cooling

water system called the jacket water system to provide cooling water to the diesel

engine, the governor oil cooler, the lube oil cooler, and the turbocharger aftercoolers.

The jacket water system is a closed loop system with an expansion tank that utilizes two

pumps, one engine driven and the other an electrical, alternating current motor-driven

pump. Both pumps have a rated flow of approximately 1800-2100 gallons per

minute (gpm). The jacket water system rejects heat to the standby service water

system through the jacket water heat exchanger.

An automatic three-way thermostatic control valve (TCV), manufactured by Amot

Controls, directs cooling water to the heat exchanger to maintain SDG temperature

between the operating range of 160EF to 175EF. During operation, approximately

200-300 gpm is bypassed by the TCV to the jacket water heat exchanger. Specifically,

thermal elements modulate the valve to maintain cooling water at design temperature.

-5- Enclosure

The GGNS TCV uses four thermal elements designed to maintain a nominal

temperature of 165EF. Each thermal element actuates independently to provide

approximately one-fourth of the valves full open stroke.

2.2 Event Summary

On January 30, 2007, GGNS discovered elevated temperatures in the jacket water

system of the Division I SDG during a monthly test run following a planned system

outage. The monthly surveillance required power to be loaded in increments of 1000 kw

up to a value greater than 5450 kw and less than 5740 kw. Approximately 5 minutes

after increasing the diesel power load to 4400 kw, the jacket water heat exchanger

outlet high temperature annunciator alarmed at 175EF. Per the procedural guidance,

the operator reduced load, shutting down the diesel in a few minutes with jacket water

temperature peaking at 180EF. This indicates that the temperature was increasing at a

rate of at least 1EF/min. The inspectors determined that GGNS met all Technical

Specification requirements during and following the event.

GGNS began preparing work orders to inspect the valve internals and replace the

thermal elements. During this time, operations completed the Technical Specification

required diesel start for the Division II SDG to verify operability. GGNS removed the

TCV internals, inspecting the thermal elements, the valve gaskets, and internal

assembly. The thermal elements and the gaskets were replaced with new parts and the

valve was reassembled. The resident inspector observed the Division I SDG retest and

verified that it passed the postmaintenance surveillance. The Division I SDG was

declared operable on February 1, 2007.

3.0 PERFORMANCE DEFICIENCIES RESULTING IN SDG FAILURE

a. Inspection Scope

On July 25, 1999, and September 22, 2004, the Division I SDG experienced high

temperatures in its jacket water and lube oil systems during performance of monthly

surveillance runs. The team reviewed the licensees corrective actions following each of

these failures to assess their effectiveness with respect to preventing the subsequent

failure that occurred on January 30, 2007.

b. Findings

Introduction. The team identified a Green noncited violation (NCV) of 10 CFR Part 50,

Appendix B, Criterion XVI, Corrective Action, for the failure to prevent recurrence of

elevated temperature events on the Division I SDG after similar events occurred in 1999

and 2004.

Description. The team noted that the licensee had documented four previous

occurrences of high temperature events on the Division I SDG since facility operation

began. The team found that documentation associated with two instances that occurred

in the late 1980's did not support meaningful analysis. The two other noted instances

occurring in 1999 and 2004 provided more insights, however, the team noted that these

evaluations were also deficient with respect to identifying the cause of failure.

-6- Enclosure

On July 27, 1999, the licensee was conducting a monthly surveillance run of the SDG,

when 80 minutes into the run, elevated jacket water and lube oil temperatures occurred

and their respective alarms were received. Operations personnel took action to secure

the SDG and temperatures in the jacket water and lube oil systems were noted to peak

at approximately 190EF. The licensee secured the SDG and declared it inoperable.

The condition was entered into the licensees corrective action program (CAP) as

Condition Report (CR) GGN-1999-0768.

This CR received a lower tier apparent cause evaluation. The actions taken for the

apparent cause evaluation were reviewed by the team and determined to be

inadequate. The apparent cause concluded that two faulty thermal elements may have

caused failure of the TCV. This conclusion was based on the fact that these two

thermal elements looked different than the other thermal elements in the Division I and

Division II SDGs. No other conclusive evidence was cited in the evaluation. The team

noted the licensee made this determination even though subsequent testing of the two

thermal elements found them functional. On the basis of this information, the team

concluded the licensee failed to determine the cause of the SDG high temperature

condition that subsequently resulted in their failure to implement effective corrective

actions to prevent recurrence.

On June 22, 2004, during a monthly surveillance run, the licensee experienced elevated

temperatures in the Division I SDG jacket water and lube oil systems along with their

respective annunciators. Again the licensee took action to secure the SDG and the

jacket water and lube oil temperatures peaked at approximately 190EF. The licensee

secured the SDG and declared it inoperable. The licensee entered this condition into

their CAP as CR GGN-2004-2575.

The licensee conducted a root cause analysis for this event. The licensee tested the

thermal elements and discovered that one was defective and had leaked some of its

paraffin material which rendered the thermal element incapable of actuating.

Additionally, the licensee discovered another thermal element failed to fully actuate

between the design specification of 0.42 to 0.48 inches. This thermal element stroked

0.40 inches. With this information, the licensee concluded that defective thermal

elements were the cause of the SDG high temperatures.

The team questioned the validity of the licensees conclusion that the thermal elements

were the cause. The team determined that since the TCV had two fully functional

thermal elements, in addition to an almost fully functioning third thermal element, that

the TCV would have been capable of opening approximately 75 percent of its full stroke

for the temperatures experienced during the 2004 event. The inspectors reached this

conclusion by adding the minimum full stroke specification for two thermal elements of

0.84 inches (0.42 inches for each thermal element) to the 0.40 inches from the partially

degraded thermal element and comparing this to the 1.625-inch full stroke for the TCV.

The team noted that the vendor manual for the TCV recommended setting up the valve

to allow full cooling flow with the valve halfway open (equivalent to approximately

0.8 inches of valve travel). The team also noted, that since initial setup of the valve, the

Division I SDG had been derated from its initial design full load capability of

7 megawatts to 5.6 megawatts and, therefore, would require even less cooling flow than

original design specifications. The inspectors concluded with these facts that the SDG

should have had adequate cooling flow with only two fully functional thermal elements.

-7- Enclosure

The team was informed by the SDG system engineer that jacket cooling water system

flow measurements were performed on the Division I SDG. These measurements were

performed at 5.6 megawatts of loading and showed that approximately 200-300 gpm of

flow were needed to be supplied to the jacket water heat exchanger of the total

1700-2100 gpm flow. The inspectors concluded from a review of the thermostatic valve

throttling characteristic curve that sufficient flow could be supplied with the valve opened

significantly less than half way.

When the inspectors combined this flow data with the ability of the remaining fully

capable thermal elements, they concluded that the thermal elements were not the cause

of the high temperature event. The inspectors concluded that the root cause was

incorrect and; therefore, did not allow the licensee to determine the cause of the SDG

high temperatures, and thereby did not allow the licensee to prevent recurrence.

Finally, on January 30, 2007, while performing a monthly surveillance run, the licensee

experienced elevated temperatures in the Division I SDG jacket water and lube oil

systems along respective alarms for the high temperatures. The inspectors concluded

from this that the licensee had not prevented recurrence of a condition which left

uncorrected could have led to the unavailability of the SDG, a key risk-significant,

safety-related mitigating component during a design basis event.

Analysis. The performance deficiency associated with this finding involved the licensee

not preventing recurrence of a significant condition adverse to quality. The finding is

greater than minor because it is associated with the mitigating systems cornerstone

attribute of equipment performance and affects the associated cornerstone objective to

ensure the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. The Phase 1 Worksheets in Manual

Chapter 0609, Significance Determination Process, were used to conclude that a

Phase 2 analysis was required because the finding represented a loss of safety function

of a single train of a Technical Specification system for greater than its allowed outage

time. The inspectors performed a Phase 2 analysis using Appendix A, Technical Basis

For At Power Significance Determination Process, of Manual Chapter 0609,

Significance Determination Process, and the Phase 2 Worksheets for Grand Gulf.

The inspectors assumed that the duration of the Division I SDG unavailability was

28 days. Additionally, the inspectors assumed the Division II SDG was unaffected and

operators could not recover the Division I SDG during a postulated high temperature

event. Based on the results of the Phase 2 analysis, the finding was determined to have

very low safety significance (Green). The senior reactor analyst's review of the Phase 2

analysis determined that a more detailed Phase 3 analysis was needed to fully assess

the safety significance. Based on the results of the Phase 3 analysis, the finding was

determined to have very low safety significance (Green). The Phase 3 analysis is

included as Attachment 3 to this report. The cause of the finding is related to the

problem identification and resolution crosscutting area in that the licensee failed to

thoroughly evaluate the problem resulting in ineffective corrective actions being

implemented that failed to prevent recurrence of a significant condition adverse to

quality.

Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, states, in

part, that for significant conditions adverse to quality, measures shall assure that the

cause of the condition is determined and corrective action taken to preclude repetition.

Contrary to the above, after the occurrence of high temperature conditions on the

-8- Enclosure

Division I SDG on July 27, 1999, and June 22, 2004, the licensee failed to assure that

the cause of these significant conditions adverse to quality were determined and that

corrective actions were taken to preclude repetition. Specifically, the licensee failed to

prevent the occurrence of a similar high temperature event on January 30, 2007. This

failure resulted in the Division I SDG being inoperable between January 2-30, 2007.

The root cause involved the licensees inappropriate determination of the thermal

elements being the cause of the Division I SDG failures. The corrective actions to

restore compliance included replacing TCV FCV-501A on March 2, 2007. Because the

finding is of very low safety significance and has been entered into the licensees CAP

as CR GGN-2007-0378, this violation is being treated as an NCV consistent with

Section VI.A of the Enforcement Policy: NCV 05000416/2007006-01, Failure to

Prevent Recurrence of High Standby Diesel Generator Temperatures.

4.0 OPERATOR RECOVERY

a. Inspection Scope

The team assessed the licensees ability to recover the SDG from the high temperature

conditions had the conditions occurred during an event. In this effort, the inspectors

reviewed the revision of the alarm response instruction for high jacket water

temperatures on the SDG in effect on January 30, 2007, along with prior revisions to the

alarm response instruction. The inspectors also questioned operators shortly after

January 30, 2007, on how to perform the alarm response instruction. Finally, the

inspectors walked down the SDG rooms after January 30, 2007, to check for adequate

staging of necessary equipment to perform the steps of the alarm response instruction.

b. Findings

Introduction. The team identified a Green NCV of Grand Gulf Technical

Specification 5.4.1 (a) pertaining to an inadequate alarm response instruction for high

SDG jacket water temperature prior to the high temperature event on the Division I SDG

on January 30, 2007.

Description. On June 22, 2004, while running the Division I SDG during a monthly

surveillance run, the SDG experienced high jacket water and lube oil temperatures

along with a high jacket water temperature alarm. The licensee entered this condition

into their CAP as CR GGN-2004-2575.

The licensee took corrective action to attempt to address the cause of the SDG high

temperatures, and also took corrective action to improve the content of the alarm

response instruction for SDG high jacket water temperatures. Because this procedural

guidance was lacking during this 2004 high temperature event, operators did not have

clear guidance on how to respond to the event and the SDG was only secured when the

operations shift manager ordered the SDG shutdown. Revision 106 of the alarm

response instruction for high jacket water temperature was inadequate in that it did not

give guidance on how operators should respond to high jacket water temperatures

during emergency and nonemergency situations.

In response to the assigned corrective action, operations procedure writers made

changes to the alarm response instruction for SDG high jacket water temperature.

These changes included providing instructions on how to manually override the SDG

-9- Enclosure

jacket water TCV FCV-501. Revision 107 of the high jacket water outlet temperature

alarm response instruction added steps for removing the valve cap, adjusting the valve

position, and monitoring system temperatures upon receiving alarms for elevated

temperatures in the SDG jacket water system. The corrective action was closed when

the alarm response instruction was revised.

On January 30, 2007, while performing a monthly surveillance run of the Division I SDG,

the SDG experienced another high temperature jacket water event. Operators secured

the SDG in accordance with Revision 107, which gives them guidance to secure the

SDG on receipt of high temperatures in a nonemergency situation. After the event, the

resident inspectors questioned three operations personnel, including one senior reactor

operator, as to how they would have carried out the alarm response instruction in an

emergency situation. The operators were unfamiliar on how to perform the specific

subparts of the step which delineates manually overriding the TCV FCV-501. The

inspectors identified procedural inadequacies in the alarm response instruction. These

are listed below:

• No details on removing TCV cap

• Unclear information on the direction to turn the TCV

• No information was given regarding the number of turns that should be made.

• No specified parameter to monitor while manually operating the TCV

• The instructions did not identify how to remove the locknut on the TCV

Although not reflective of the quality of the alarm response instruction, the inspectors

also discovered that not all of the required tools were available to perform the manual

override operation. In noting the lack of detailed guidance in the procedure and the

unavailability of tools required by the procedure to perform these critical steps, the

inspectors concluded that the alarm response instruction for the SDG TCV was

inadequate.

Analysis. The performance deficiency associated with this finding involved the licensee

not maintaining an adequate procedure. The finding is greater than minor because it is

associated with the mitigating systems cornerstone attribute of procedure quality and

affects the associated cornerstone objective to ensure the availability, reliability, and

capability of systems that respond to initiating events to prevent undesirable

consequences. Using Manual Chapter 0609, Significance Determination Process,

Phase 1 Worksheet, the finding is determined to have very low safety significance

because it did not screen as potentially risk significant due to a seismic, flooding, or

severe weather initiating events. The cause of the finding is related to the problem

identification and resolution crosscutting area in that the licensee did not take

appropriate corrective actions to adequately address a previously identified safety

concern.

Enforcement. Grand Gulf Technical Specification 5.4.1 (a) requires that written

procedures be established, implemented, and maintained covering the activities

specified in Appendix A, Typical Procedures for Pressurized Water Reactors and

Boiling Water Reactors, of Regulatory Guide 1.33, Quality Assurance Program

Requirements (Operation), dated February 1978. Regulatory Guide 1.33, Appendix A,

Section 5, Procedures for Abnormal, Offnormal, or Alarm Conditions, requires

procedures for safety-related annunciators to have written procedures which contain

immediate operation action and long-range actions. Contrary to this, prior to

-10- Enclosure

January 30, 2007, Procedure 04-1-02-1H22-P400, Alarm Response Instruction,

Panel 1H-22-P400, Safety Related, Revision 107, was not adequate. Specifically, the

procedure did not provide adequate guidance for immediate operation action and

long-range action for manually overriding the SDG TCV. The root cause involved not

ensuring all needed instructions were included in the procedure revision. The corrective

actions to restore compliance included properly revising the procedure and training

operators on manual operation of the valve. Because the finding is of very low safety

significance and has been entered into the licensees CAP as CR GGN-2007-1837, this

violation is being treated as an NCV consistent with Section VI.A of the Enforcement

Policy: NCV 05000416/2007006-02, Inadequate Alarm Response Instruction for SD

Generator High Jacket Water Temperature.

5.0 CORRECTIVE ACTIONS FOLLOWING SDG FAILURES

a. Inspection Scope

The team assessed the licensees immediate and long-term planned corrective actions

associated with the Division I SDG failure that occurred on January 30, 2007. The team

assessed the engineering and operations departments implementation of the operability

determination (OD) process immediately after the failure and then after identifying that

the maintenance they had conducted to the TCV may not have corrected the cause of

the failure. This assessment was performed through interviews, review of operator logs,

corrective action documents, ODs, work orders, and related documents.

b. Findings

(1) Failure To Identify Actions Taken After SDG Inoperability Were Inadequate

Introduction. The inspectors identified a Green NCV of 10 CFR Part 50, Appendix B,

Criterion XVI, Corrective Action, for the licensees failure to identify that their corrective

action after the January 2007 high temperature event on the Division I SDG were not

adequate.

Description. On January 30, 2007, the Division I SDG experienced the high temperature

event. Operators shut down the SDG and declared it inoperable in an effort to

troubleshoot the cause of the high temperatures. During their troubleshooting and

maintenance, the licensee cleaned and inspected the internals of TCV FCV-501, and

replaced the valves thermal elements and o-rings. After reviewing the conduct of this

maintenance, reviewing input from engineering personnel as to the operability of the

SDG, and conducting a satisfactory surveillance run, operations personnel declared the

SDG operable.

The licensee entered the high temperature event on the Division I SDG in their CAP as

CR GGN-2007-0378 and began a root cause determination to find the cause of the

failure. In this effort, the licensee tested the thermal elements from the TCV for the

SDG at GGNS on February 2, 2007. This testing did not identify any failures of the

thermal elements. At that point, the licensee did not recognize, as an organization, that

their implemented corrective actions failed to fix the failure mechanism. The resident

inspectors subsequently questioned the operability with the licensee at which time they

stated they were sending the thermal elements to the vendor for further testing and

-11- Enclosure

were waiting on those additional testing results. The inspectors considered that the

licensee missed an opportunity to identify that the SDG was not fully operable at this

time.

On February 9, 2007, the additional vendor testing identified no thermal element

failures. Engineering department personnel developed a white paper later that day and

distributed to selected site personnel. The white paper stated that binding of the valve

appeared to be the cause of the failure. Licensee personnel, including representatives

from the operations department, evaluated the white paper, but did not exercise their

processes to evaluate this condition in their CAP. As a result, the licensee did not

formally question the operability of the valve in an OD. The inspectors considered that

the licensee missed another opportunity to identify that the SDG was not fully operable

at this time.

The special inspection team was sanctioned by NRC Region IVs management and

arrived on site on February 12, 2007. As part of their charter, the inspection began to

question operability of the SDG since it appeared that the thermal elements were

definitely suspect as the cause of the SDG high temperature event. On February 14,

2007, the team questioned operability. Operations, engineering, and licensing

department personnel questioned by the inspectors stated there was no conclusive

information on the failure mechanism, and the decision was made to wait for completion

of the root cause investigation prior to considering the valve degraded. The inspectors

considered that the licensee missed yet another opportunity to identify that the SDG was

not fully operable at this time.

On February 15, 2007, the special inspection team debriefed plant management and

discussed their concern that the valve was potentially degraded and that the inspectors

questioned the licensees evaluation of the operability. Following this debrief, the

licensee entered the condition into their corrective action process as

CR GGN-2007-0660 and performed an operability evaluation, in which the licensee

declared the SDG degraded but operable based on engineering judgement. The

inspectors considered that the licensee had gone nearly 2 weeks with mounting

evidence that the thermal elements were not the cause of the SDG failure yet had not

taken action to enter this deficient condition into their CAP.

Analysis. The performance deficiency associated with this finding involved the

licensees failure to identify a significant condition adverse to quality. The finding is

greater than minor because it is associated with the mitigating systems cornerstone

attribute of equipment performance and affects the associated cornerstone objective to

ensure the availability, reliability, and capability of systems that respond to initiating

events to prevent undesirable consequences. Using Manual Chapter 0609,

Significance Determination Process, Phase 1 Worksheet, the finding is determined to

have very low safety significance because the condition did not screen as potentially risk

significant due to a seismic, flooding, or severe weather initiating events. The cause of

the finding is related to the problem identification and resolution crosscutting area in that

the licensee did not identify an issue completely, accurately, and in a timely manner

commensurate with its safety significance resulting in the failure to evaluate a potential

degraded condition for operability.

Enforcement. 10 CFR Part 50, Appendix B, Criterion XVI, Corrective Action, requires,

in part, that measures be established to assure that conditions adverse to quality, are

-12- Enclosure

promptly identified and corrected. Contrary to the above, between February 2-15, 2007,

the licensee did not promptly identify the fact that their corrective actions were not

addressing the cause of the Division I SDG high temperature event based on evidence

that the thermal elements of TCV FCV-501 were not the faulty subcomponent of the

valve. The root cause involved the licensees reliance on successful valve operation

after performing similar TCV maintenance. The corrective actions to restore compliance

included the licensee reassessing their OD of the SDG and replacing the TCV on

March 2, 2007. Because the finding is of very low safety significance and has been

entered into the licensees CAP as CR GGN-2007-2255, this violation is being treated

as an NCV consistent with Section VI.A of the Enforcement Policy:

NCV 05000416/200706-03, Failure to Promptly Identify a Degraded Condition.

(2) Failure To Follow Procedures Resulting In An Inadequate Operability Evaluation

Introduction. The inspectors identified a Green NCV of 10 CFR Part 50 Appendix B,

Criterion V, for a failure to follow procedures which resulted in an inadequate operability

evaluation.

Description. On February 15, 2007, the licensee initiated CR GGN-2007-0660 in

response to the high failure frequency of the jacket water TCV on the Division I SDG.

Control room operators performed an immediate OD and declared the SDG operable

based on engineering judgement. The operators completed a Reasonable Expectation

of Operability form in accordance with Procedure EN-OP-104, Operability

Determinations, Revision 2, and documented the basis of the OD as the maintenance

that had recently been performed on the valve and the short length of time until the next

scheduled maintenance window relative to the observed failure frequency. Operators

issued a corrective action to the engineering staff to provide a detailed technical

justification for the calculated failure frequency of the TCV or, alternatively, to provide a

detailed technical explanation for how the recently performed maintenance on the valve

would prevent future failures when previous maintenance activities had not.

The engineering staff completed the operability evaluation on February 16, 2007.

Control room operators immediately declared the SDG operable, stating the corrective

action response provided sound basis for the operability of the equipment. The

inspectors reviewed the operability evaluation and noted the technical justifications for

the valve failure frequency and the maintenance performed appeared to have been

copied nearly verbatim from the original Reasonable Expectation of Operability form.

The inspectors concluded the evaluation provided virtually no new information beyond

what had already been documented in the CR and was therefore an incomplete

response to the corrective action assignment.

The inspectors further noted the operability evaluation did not include an analysis of

what could have been causing the TCV to fail, and it provided no assessment of the

effect the degraded condition would have related to the specified safety function and

mission time of the SDG. The evaluation also failed to consider the risk of the

engineering judgement being wrong. The inspectors concluded the acceptance of

evaluation by operators was contrary to Procedure EN-LI-102, Corrective Action

Process, Revision 8, which required the assigners of corrective actions to ensure the

response was complete and adequate before closing the corrective action assignment.

-13- Enclosure

The inspectors expressed the above concerns to licensee management. On

February 28, 2007, the licensee declared the Division I SDG inoperable in lieu of

performing a complex evaluation of compensatory actions. The jacket water

temperature control valve was replaced on March 2, 2007.

Analysis. The failure to require an adequate corrective action response per station

procedures was a performance deficiency. This finding is more than minor because the

failure to perform an adequate operability evaluation, if left uncorrected, could become a

more significant safety concern. Using Manual Chapter 0609, Significance

Determination Process, Phase 1 Worksheet, this finding was of very low safety

significance since it did not result in a loss of operability. The cause of this finding has

a crosscutting aspect in the area of human performance associated with decision

making because licensee personnel failed to use conservative assumptions and did not

verify the validity of the underlying assumptions used in making safety-significant

decisions.

Enforcement. 10 CFR Part 50, Appendix B, Criterion V, Instructions, Procedures and

Drawings, states, in part, that activities affecting quality shall be prescribed by

documented instructions and shall be accomplished in accordance with those

instructions. Contrary to the above, on February 16, 2007, licensee operators failed to

implement Section 5.8[4] of Procedure EN-LI-102, Corrective Action Process,

Revision 8, which required assigners of corrective actions to ensure required actions are

complete and corrective action responses are adequate. Because this violation was of

very low safety significance and was entered in the corrective action program as

CR GGN-2007-2256, this violation is being treated as a NCV consistent with

Section VI.A.1 of the NRC Enforcement Policy: NCV 05000416/2007006-04, Failure to

Follow Procedures Resulting in an Inadequate Operability Evaluation.

4OA6 Meetings, Including Exit

On March 14, 2007, the initial results of this inspection were presented to Mr. R. Brian,

Vice President, Operations, and other members of his staff who acknowledged the

findings. Additionally on April 25, 2007, the final results of this inspection were

presented to Mr. J. Reed, General Manager, Plant Operations, and other members of

his staff who acknowledged the findings. The inspector asked the licensee whether any

of the material examined during the inspection should be considered proprietary. No

proprietary information was identified.

ATTACHMENT 1: SUPPLEMENTAL INFORMATION

ATTACHMENT 2: SPECIAL INSPECTION CHARTER

ATTACHMENT 3: SIGNIFICANCE DETERMINATION EVALUATION

-14- Enclosure

SUPPLEMENTAL INFORMATION

KEY POINTS OF CONTACT

Licensee Personnel

C. Abbott, Acting Quality Assurance Manager

D. Barfield, Director, Nuclear Safety Assurance

B. Blanche, Operations Shift Manager

C. Bottemiller, Manager, Plant Licensing

R. Brian, Vice President, Operations

F. Bryan, Project Manager

R. Collins, Operations Manager

J. Edwards, Minority Owner Representative, SMEPA

C. Ellsaesser, Manager, Planning, Scheduling, and Outages

P. Griffith, Senior Engineer

E. Harris, Manager, Corrective Actions and Assessments

M. Krupa, Director, Engineering

M. Larson, Senior Licensing Specialist

J. Reed, General Manager, Plant Operations

M. Rohrer, Manager, System Engineering

G. Smith, Senior Engineer

G. Swords, Root Cause Analysis Evaluator

F. Weaver, Assistant Operations Manager

D. Wiles, Director, Engineering

R. Wright, Engineering Supervisor

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED

Opened and Closed

05000416/2007006-01 NCV Failure to Prevent Recurrence of High Standby Diesel

Generator Temperatures (Section 3.0)05000416/2007006-02 NCV Inadequate Alarm Response Instruction for SDG High

Jacket Water Temperature (Section 4.0)05000416/2007006-03 NCV Failure to Promptly Identify a Degraded Condition

(Section 5.0)05000416/2007006-04 NCV Failure to Follow Procedures Resulting in an Inadequate

Operability Evaluation (Section 5.0)

A1-1 Attachment 1

LIST OF DOCUMENTS REVIEWED

Procedures

Number Title Revision

02-S-1-28 Diesel Generator Start Log 2

04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 106

Safety Related

04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 107

Safety Related

04-1-02-1H22-P400 Alarm Response Instruction, Panel No.: 1H-22-P400, 109

Safety Related

07-S-24-P75-F501-1 Jacket Water Thermostatic Valve Thermal Element 5

Replacement

06-OP-1P75-M-0001 Standby Diesel Generator 11 Function Test 128

06-OP-1P75-M-0002 Standby Diesel Generator 12 Functional Test 106

EN-LI-102 Corrective Action Process 108

EN-OP-104 Operability Determinations 2

CRs

CR-GGN-1993-0195 CR-GGN-2004-1949 CR-GGN-2005-2208

CR-GGN-1998-0446 CR-GGN-2004-2525 CR-GGN-2005-2331

CR-GGN-1998-0608 CR-GGN-2004-2575 CR-GGN-2005-2563

CR-GGN-1999-0768 CR-GGN-2004-2581 CR-GGN-2005-2785

CR-GGN-1999-0817 CR-GGN-2004-2620 CR-GGN-2005-2786

CR-GGN-1999-0966 CR-GGN-2004-2775 CR-GGN-2005-2850

CR-GGN-1999-1229 CR-GGN-2004-2854 CR-GGN-2005-2880

CR-GGN-2000-0133 CR-GGN-2004-3088 CR-GGN-2005-2991

CR-GGN-2000-0170 CR-GGN-2004-3324 CR-GGN-2005-3078

CR-GGN-2001-1705 CR-GGN-2004-3352 CR-GGN-2005-5272

CR-GGN-2002-0551 CR-GGN-2004-3353 CR-GGN-2005-5443

CR-GGN-2002-0557 CR-GGN-2004-3360 CR-GGN-2006-0776

CR-GGN-2002-0891 CR-GGN-2004-4116 CR-GGN-2006-0852

A1-2 Attachment 1

CR-GGN-2002-1224 CR-GGN-2004-4596 CR-GGN-2006-0952

CR-GGN-2002-1821 CR-GGN-2004-4610 CR-GGN-2006-1461

CR-GGN-2002-2041 CR-GGN-2004-4616 CR-GGN-2006-3101

CR-GGN-2003-1004 CR-GGN-2005-0160 CR-GGN-2006-4082

CR-GGN-2003-1074 CR-GGN-2005-0345 CR-GGN-2007-0378

CR-GGN-2003-1088 CR-GGN-2005-0554 CR-GGN-2007-0400

CR-GGN-2003-1164 CR-GGN-2005-1225 CR-GGN-2007-0417

CR-GGN-2003-1395 CR-GGN-2005-1554 CR-GGN-2007-0427

CR-GGN-2004-1586 CR-GGN-2005-1730

Industry Information/Operational Experience

Comanche Peak Steam Electric Station Smartform SMF-2000-002502-00

Licensee Event Report 86-033-00, Manually Shut Down During Surveillance Test Due to High

Lube Oil Temperature

Licensee Event Report 91-010-00, Technical Specification Required Shutdown Due to an

Inoperable Standby Diesel Generator

NRC Information Notice 91-85, Potential Failures of Thermostatic Control Valves for Diesel

Generator Jacket Water

NRC Information Notice 82-56, Robertshaw Thermostatic Flow Control Valves

Part 21 Report 1997-04-0, Seabrook Station, Supplement to Diesel Generator Special Report

Work Orders/Maintenance Work Orders

MWO 03536 Receipt inspection of Amot Type-D Serial Number A761

MWO 34475 Rework and replace power elements

MWO 50207 Division I temperature control valve adjustment

MWO 51507 Rebuild spare valve assembly

MWO 64290 Remove and rebuild valve internals

MWO 81841 Installation of new power elements

WO 46758 Replace thermal elements

WO 67751 Replace thermal elements

A1-3 Attachment 1

WO 81761 Replace thermal elements

WO 102717 Re-torque flange bolting

WO 207466 Low jacket water temperature troubleshooting

Drawings

Number Title Revision

M-1070A Standby Diesel Generator System 39

M-1070C Standby Diesel Generator System 18

M-1093B High Pressure Core Spray Diesel Generator System 24

C641 Amot Type 8D 4

Miscellaneous Information

AECM 88/0099, Letter from John G. Cesare, Jr., Director of Nuclear Licensing to USNRC,

dated May 4, 1988, Diesel Shutdown Due to High Lube Oil Temperature

Calculation E-DCP 82/5020-1, Transient Loading on Diesel Generators During Load

Sequencing

Engineering Report GGNS-01-0001, Study to Determine Feasibility of Extending Frequencies

of Division I and Division II Standby Diesel Generator Outage Related Maintenance

Inspections, Revision 0

Grand Gulf Nuclear Station IR-88-4-3

Grand Gulf Nuclear Station Inservice Testing Bases Document, Program Section

N0.CEP-IST-1, Revision 4

GTC 2004/00091, Additional testing of SDG thermal elements

LO-CAR-2004-121

Maintenance Personnel Interviews, February 9, 2007

Purchase Order 11517

Purchase Order 10067787

Standby Diesel Generator Start Logs (Divisions I and II)

Texas Utilities Certificate of Conformance for Order S02915836S2

Vendor Manual 460000452, Amot Model 8D Thermostatic Valve

A1-4 Attachment 1

LIST OF ACRONYMS

CAP corrective action program

CFR Code of Federal Regulations

CR condition report

GGNS Grand Gulf Nuclear Station

gpm gallons per minute

NCV noncited violation

NRC U.S. Nuclear Regulatory Commission

OD operability determination

SDG standby diesel generator

TCV thermostatic control valve

A1-5 Attachment 1

February 8, 2007

MEMORANDUM TO: Richard W. Deese, Senior Resident Inspector, Arkansas Nuclear One

Project Branch E, Division of Reactor Projects

Andrew J. Barrett, Resident Inspector, Grand Gulf Nuclear Station

Project Branch C, Division of Reactor Projects

FROM: Arthur T. Howell III, Director, Division of Reactor Projects AVegel for /RA/

SUBJECT: SPECIAL INSPECTION CHARTER TO EVALUATE THE GRAND

GULF NUCLEAR STATION EMERGENCY DIESEL GENERATOR

FAILURE

A Special Inspection Team is being chartered in response to the Grand Gulf Nuclear Station

emergency diesel generator (EDG) failure. The diesel had to be manually tripped during

surveillance testing on January 30, 2007. You are hereby designated as the Special Inspection

Team members. Mr. Deese is designated as the team leader. The assigned SRA to support

the team is Russ Bywater.

A. Basis

On January 30, 2007, during performance of a monthly surveillance test, EDG 1 was

manually shut down by operators due to a jacket water high water temperature alarm

and indications of temperatures rising significantly faster than normal. The licensee

determined that the condition resulted from a faulty thermostatic temperature control

valve (TCV) that supplies cooling water to the EDG jacket water cooling system. The

licensee has preliminarily identified the cause of the failure to be the thermal elements

inside the TCV. The licensee has experienced previous TCV failures in 1999 and 2004.

These failures resulted in replacing the thermal elements. Based on the most recent

failure of the thermal elements on EDG 1 and previous licensee efforts to identify and

correct EDG thermal element problems, it is questionable whether the effectiveness of

the licensees corrective actions has been adequate.

Failure of these TCV thermal elements has also previously occurred at other nuclear

facilities, resulting in EDG failures due to overheating, resulting in crankcase explosions.

One such occurrence is documented in NRC Information Notice 91-85, Potential

Failures of Thermostatic Control Valves for Diesel Generator Jacket Cooling Water.

A2-1 Attachment 2

B. Scope

The team is expected to address the following:

a. Develop an understanding of the EDG degraded conditions and failures related

to TCV problems.

b. Assess licensee effectiveness in identifying previous EDG thermostatic valve

problems, evaluating the cause of these problems and implementation of

corrective actions to resolve identified problems.

c. Identify and assess additional actions planned by the licensee in response to

repetitive problems with the EDG 1 TCV, including the timeline for completion of

these actions.

d. Assess the licensees root cause evaluation, the extent of condition, and the

licensees common mode evaluation.

e. Evaluate pertinent industry operating experience and potential precursors to the

January 30 event, including the effectiveness of licensee actions taken in

response to the operating experience.

f. Determine if there are any potential generic issues related to the failure of the

EDG 1 thermostatic control valve. Promptly communicate any potential generic

issues to Region IV management.

g. Determine if the Technical Specifications were met when the diesel was

manually secured prior to tripping on high temperature.

h. Collect data as necessary to support a risk analysis.

C. Guidance

Inspection Procedure 93812, Special Inspection, provides additional guidance to be

used by the Special Inspection Team. Your duties will be as described in Inspection

Procedure 93812. The inspection should emphasize fact-finding in its review of the

circumstances surrounding the event. It is not the responsibility of the team to examine

the regulatory process. Safety concerns identified that are not directly related to the

event should be reported to the Region IV office for appropriate action.

The Team will report to the site, conduct an entrance, and begin inspection no later than

February 12, 2007. While on site, you will provide daily status briefings to Region IV

management, who will coordinate with the Office of Nuclear Reactor Regulation, to

ensure that all other parties are kept informed. A report documenting the results of the

inspection should be issued within 30 days of the completion of the inspection.

A2-2 Attachment 2

This Charter may be modified should the team develop significant new information that

warrants review. Should you have any questions concerning this Charter, contact me at

(817) 860-8144.

A2-3 Attachment 2

Attachment 3: Significance Determination Evaluation

Significance Determination Process (SDP)

Phase 1 Screening

The finding was more than minor because it affected the equipment performance

attribute of the mitigating system cornerstone due to the impact on availability and

reliability of the emergency diesel generator.

In accordance with NRC Inspection Manual Chapter 0609, Appendix A, Determining the

Significance of Reactor Inspection Findings for At-Power Situations, dated March 23,

2007, the inspectors conducted a SDP Phase 1 screening and determined that the

finding resulted in loss of the safety function of Division 1 Standby Diesel

Generator (DG) for greater than the Technical Specification allowed outage time.

Consequently, a Phase 2 SDP risk significance estimation was required.

Phase 2 Risk Significance Estimation

Internal Events and Large Early Release Frequency (LERF)

In the Phase 2 SDP evaluation, the inspectors and a RIV senior reactor analyst (SRA)

performed a Phase 2 evaluation using the Risk-Informed Inspection Notebook for Grand

Gulf Nuclear Station, Revision 2.01, (SDP Phase 2 Notebook) and its associated

Phase 2 Pre-solved Table.

Assumptions:

• Exposure Time

The time between the last successful Division I DG surveillance test on

January 2, 2007, and the January 30, 2007, surveillance test during which the

Division I DG failed was 28 days. Based on review of the DG keep-warm system

design and its operation while the engine was in a standby condition, the

inspectors determined that the keep-warm system maintained coolant

temperature below the setpoint of the temperature control valve. This meant that

the temperature control valve would not have operated while the engine was in a

standby condition. Therefore, the inspectors concluded that the temperature

control valve (and the DG) could reasonably been known to have been

nonfunctional for a 28-day exposure period. Therefore, the inspectors used a

3-30 days exposure time in the Phase 2 Evaluation when determining the

appropriate Initiating Event Likelihood (IEL).

• Recovery Credit

The high-temperature trip of the DG is bypassed during emergency start of the

engine, as would be expected during a LOOP. The inspectors determined that

after an emergency start, operators would not be capable of diagnosing the

A3-1 Attachment 3

problem and locally operating the temperature control valve prior to failure of the

DG due to excessive temperature. Therefore, recovery was not credited.

Phase 2 SDP Evaluation Method:

The Division I DG was identified as a target in the Phase 2 pre-solved table. Per the

guidance in IMC 0609, Appendix A, the pre-solved table could be used directly to

assess the finding. The table identified that the finding was CDF-dominant.

Therefore, no additional review was required for LERF consideration. For a 3 - 30 day

exposure time, the pre-solved table identified that the significance of the finding was

Green with respect to CDF. The dominant sequence (with an equivalent risk

contribution of 7) involved a station blackout (LOOP with failure of the Division I, II,

and III DGs), failure of RCIC, and failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This

sequence is represented as: LOOP - EAC 1&2 -EDG3 - RCIC - REC1.

LERF

As described above, the finding was CDF-dominant. No LERF assessment was

required.

External Events

Neither the Grand Gulf SDP Phase 2 Notebook nor the pre-solved table includes

screening capability for external events or other initiating events. Because the risk

contribution of the finding due to internal events was green with significance greater

than 1E-7/year, additional evaluation was required to determine if external initiators

could be risk significant. Experience has shown using the Risk-Informed Inspection

Notebooks that accounting for external initiators could result in increasing the risk

significance of an inspection finding by as much as one order of magnitude. The SRA

determined that the most efficient method of accounting for external initiators was to

perform a Phase 3 analysis, while using the guidance provided in IMC 0609,

Appendix AProperty "Inspection Manual Chapter" (as page type) with input value "NRC Inspection Manual 0609,</br></br>Appendix A" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process., Attachment 3, User Guidance for Screening of External Events Risk

Contributions.

Phase 3 SDP Analysis

Internal Events

Assumptions:

• Exposure Time

Based on the available information from the inspectors and the licensee's root

cause assessment, and after review by other risk analysts from the Office of

Nuclear Reactor Regulation, the finding was assumed best represented by a

14-day (T/2) exposure time. This was because the analysts could not

A3-2 Attachment 3

conclusively determine from the information provided that the temperature

control valve was in a certain-to-fail condition following the January 2, 2007,

surveillance, or if the valve had some higher random failure probability.

Therefore, a 14-day exposure time was assumed.

• Recovery Credit

As in the Phase 2 Evaluation, no operator recovery credit was assumed.

• Common-Cause Failure Consideration

The temperature control valves for the Division I and Division II DGs were both

AMOT Model 8DOC 165-01 valves. The Division III DG temperature control

valve, although from the same manufacturer and of the same principle of

operation, was an AMOT Model 4BOC 170-01 valve, with different design and

function. Therefore, no common-cause failure mechanism was considered

applicable to the Division III DG. However, common-cause was assumed

applicable to the Division II DG. In other words, the failure of the Division I DG

could not be modeled as an independent failure. Consistent with the RASP

Handbook, a component failure should only be modeled as an independent

failure if the cause is well understood and there is no possibility that the same

circumstance exists in other components in the same common-cause component

group.

Phase 3 SDP Analysis Method:

Internal Events

For the Phase 3 SDP analysis, the SRA used the NRC's simplified plant analysis risk

(SPAR) model for Grand Gulf Nuclear Station, Revision 3.31, dated October 10, 2006,

to estimate the risk associated with the finding. Average test and maintenance was

assumed and a cutset truncation of 1.0E-12 was used. The finding was modeled by

setting the basic events for the Division I DG failure-to-start equal to TRUE and the

Division I DG failure-to-run equal to 1.0. These changes would invoke appropriate

changes to address consideration of common-cause failures as discussed above.

Another change involved setting a basic event in the SPAR model that was no longer

applicable to FALSE. This event, discovered during a cutset-level review of the results,

involved operator action to bypass RCIC isolation on high steam tunnel temperature.

The licensee provided a calculation that indicated that steam tunnel temperature would

not reach isolation setpoint temperature in time to be of concern and therefore, did not

need to be modeled for this analysis. The resulting internal event analysis was an

increase in the core damage frequency of 4.05E-7/yr for a 14-day exposure period. The

dominant sequence (contributing about 25 percent of the total increase in core damage

frequency) involved a LOOP, followed by failure of the Division I, II, and III DGs, and

failure to recover a DG or offsite power within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

A3-3 Attachment 3

LERF

Core damage sequences involving a potential contribution to LERF were considered.

The dominant core damage sequence that was a potential LERF contributor involved a

LOOP with DG failures, and failure to recover a DG or offsite power within 30 minutes

when RCIC had failed to start. The resulting increase in core damage frequency

associated with this sequence was less than 1E-7/yr. Therefore, in accordance with

IMC 0609, Appendix H, Containment Integrity Significance Determination Process, this

finding was not significant with respect to LERF.

External Events (Including Internal Flooding)

Seismic

Using information from IMC 0609, Appendix A, Attachment 3, and the licensee's IPEEE

(Individual Plant Examination of External Events) the SRA determined that the finding

may have been substantial enough to alter the Phase 2 result because the Division I DG

was on the licensee's seismic safe shutdown list, was used to mitigate the

consequences of a loss of offsite AC power during a seismic event, and the exposure

time was greater than 3 days. However, when the SRA evaluated the seismic

contribution using the Seismic Event Modeling and Seismic Risk Quantification

Handbook of the RASP External Events Handbook, the estimated delta CDF of a

seismically-induced LOOP with a random failure of the Division II DG for a 14-day

exposure period was in the mid E-9/year range. Therefore, the seismic risk contribution

of the finding is insignificant relative to the internal events result.

Flood

Using IMC 0609, Appendix A, Attachment 3, Table 3.1, Plant Specific Flood Scenarios

and Initiator Frequencies, the SRA determined that the Division I DG was not a

structure, system, or component identified as critical to avoiding core damage for any

flood scenario of significance. Therefore, flood risk contribution was screened out from

further consideration.

Fire

The Division I DG is in the protected train of the post-fire safe shutdown path.

Therefore, the finding was potentially significant with respect to its contribution from fire

events.

The licensee has a fire PRA which has the capability of assessing the risk impact of

nonfunctional equipment for fires in all fire areas with the exception of the control room.

For control room fires, the licensee can use its fire PRA to calculate conditional core

damage prababilities for the control room fire groups identified in the IPEEE. The

licensee provided this information to the SRA to assess the risk contribution due to fires

with the Division I DG out of service. The SRA considered this information provided by

A3-4 Attachment 3

the licensee to be the best available information in the context of IMC 0609 goals of

obtaining from the licensee readily available information to best inform the NRC staff's

preliminary significance determination in a timely manner.

The results of the fire analysis with the Division I DG nonfunctional for 14 days were as

follows:

control room fires: delta CDF = 1.34E-7/year

other fire areas: delta CDF = 5.75E-8/year

total fire contribution: delta CDF = 1.92E-7/year

Based on the above evaluation and guidance provided in IMC 0609, Appendix A,

Attachment A, the SRA concluded the total contribution to risk significance of this finding

due to external initiators was approximately 1.92E-7/year.

Total Estimated Change in Core Damage Frequency

The total risk contribution of the finding is expressed as the summation of the internal

events contribution and the external events contribution. This result is:

Internal Events: delta CDF = 4.05E-7/year

External Events: delta CDF = 1.92E-7/year

Total: delta CDF = 5.97E-7/year

In conclusion, the risk significance of this finding with respect to increase in core

damage frequency is of very low safety significance (Green).

Licensee's Risk Evaluation

The licensee evaluated the finding in two ways. The first case assumed the Division I

DG was not functional for 14 days. The second case evaluated a degraded condition

of the Division I DG rather than it being not functional resulting in an increased

unreliability (increased failure-to-start probability) for an extended period prior to the

January 30, 2007, test failure. Using this approach, the licensee evaluated past

surveillance testing data and estimated that the increase in the failure-to-start probability

for the Division I DG due to the performance deficiency was 2.94E-2. For this case, the

licensee used a 1-year exposure time, the maximum exposure time generally used in

SDP evaluations.

The licensee's results for these cases were as follows:

A3-5 Attachment 3

Case 1 (DG I not Case 2 (DG I increased FTS probability for 1

functional for 14 year)

days)

Internal Events 3.59E-7/year 2.6E-7/year

delta CDF

External Events 1.91E-7/year 1.7E-7/year

(Fire) delta CDF

Total delta CDF 5.5E-7/year 4.3E-7/year

In either case, the results were in agreement with the SRAs analysis and also

supported the conclusion that the finding was of very low safety significance (Green).

A3-6 Attachment 3